CVE-2018-19841

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-04 · updated 2026-06-17
Weakness: CWE-125

Description

The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
Debian Linux: 9.0
Fedoraproject Fedora: 28, 29, 30, 31
openSUSE Leap: 15.0
WavPack: through 5.1.0

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00029.html
http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html
https://github.com/dbry/WavPack/commit/bba5389dc598a92bdf2b297c3ea34620b6679b5b
https://github.com/dbry/WavPack/issues/54
https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BLSOEVEKF4VNNVNZ2AN46BJUT4TGVWT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZGXJUHCGQI6XKLCBUZHXPYIIWMFWA22/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVVKOBJR5APOB3KWUWJ4UWQHUBZQL6C6/
https://seclists.org/bugtraq/2019/Dec/37
https://security.gentoo.org/glsa/202007-19

Get alerted when CVE-2018-19841 or the next vulnerability affects your stack